CVE-2024-36965 (GCVE-0-2024-36965)
Vulnerability from cvelistv5
Published
2024-06-08 12:52
Modified
2026-08-05 11:32
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well. Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic. To fix that, check that the IPI buffer fits, otherwise return a failure and refuse to boot the relevant SCP core (or the SCP at all, if this is single core).
References
Impacted products
Vendor Product Version
Linux Linux Version: 3efa0ea743b77d1611501f7d8b4f320d032d73ae
Version: 3efa0ea743b77d1611501f7d8b4f320d032d73ae
Version: 3efa0ea743b77d1611501f7d8b4f320d032d73ae
Version: 3efa0ea743b77d1611501f7d8b4f320d032d73ae
Version: 3efa0ea743b77d1611501f7d8b4f320d032d73ae
Version: 3efa0ea743b77d1611501f7d8b4f320d032d73ae
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.595Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36965",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:15:29.133298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:58.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/mtk_scp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00548ac6b14428719c970ef90adae2b3b48c0cdf",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "1d9e2de24533daca36cbf09e8d8596bf72b526b2",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "26c6d7dc8c6a9fde9d362ab2eef6390efeff145e",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "838b49e211d59fa827ff9df062d4020917cffbdf",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "36c79eb4845551e9f6d28c663b38ce0ab03b84a9",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "331f91d86f71d0bb89a44217cc0b2a22810bbd42",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/mtk_scp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.160",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.92",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.32",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.11",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\n\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it\u0027s not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it\u0027s\nstill useful to check on single-core variants as well.\n\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\n\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by local means only \u2014 an unprivileged open() of /dev/video* (mtk-vcodec) or a write to /sys/class/remoteproc/*/state, with the firmware image read from the local filesystem. There is no network or remote-peer input involved.\nAC:L - The out-of-range `.ipi_buffer` sh_addr is a static, deterministic property of the loaded firmware image, so once the vulnerable configuration exists the OOB access happens 100% of the time; where the attacker supplies the image, the offset is directly and fully attacker-chosen. No race, no memory grooming, no unpredictable precondition.\nPR:L - An unprivileged local user with access to the V4L2 codec node (video group, standard on ChromeOS/Android MediaTek devices) triggers rproc_boot() \u2192 scp_parse_fw() \u2192 scp_ipi_init() by simply opening /dev/video0, and subsequently drives userspace-influenced data through the out-of-bounds send_buf via IPI. No capability or root is needed to reach the unvalidated code.\nUI:N - The attacker performs the triggering open()/ioctl sequence itself; no victim action is required, and on default configurations rproc-\u003eauto_boot even runs the path unattended at probe.\nS:U - The out-of-bounds reads and writes land in the kernel\u0027s own ioremap/vmalloc address space and are handled entirely by the kernel\u0027s security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - scp_ipi_handler() performs readl()/memcpy_fromio() from the out-of-bounds recv_buf and hands up to ~600 bytes of that out-of-range memory to registered IPI handlers, whose contents surface to userspace through vcodec/rpmsg \u2014 an unbounded kernel-address-space read primitive controlled by the offset.\nI:H - scp_ipi_init() memset_io()s past the L2TCM mapping, and scp_ipi_send() writes up to a full IPI payload of userspace-influenced bytes at sram_base+offset \u2014 an out-of-bounds write at an offset reachable across a 4GB range of the kernel\u0027s vmalloc/ioremap region, able to corrupt neighbouring MMIO registers, the other SCP core\u0027s L2TCM, or other vmalloc\u0027d kernel objects.\nA:H - The commit message states the unchecked R/W past the L2TCM boundary results \"(at best) in a kernel panic\"; touching unmapped ioremap VA raises an unrecoverable data abort, and the resulting corruption can hang or crash the system, reproducible on every boot/open."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:20.070Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"
        },
        {
          "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"
        }
      ],
      "title": "remoteproc: mediatek: Make sure IPI buffer fits in L2TCM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36965",
    "datePublished": "2024-06-08T12:52:58.404Z",
    "dateReserved": "2024-05-30T15:25:07.081Z",
    "dateUpdated": "2026-08-05T11:32:20.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.595Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36965\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:15:29.133298Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.300Z\"}}], \"cna\": {\"title\": \"remoteproc: mediatek: Make sure IPI buffer fits in L2TCM\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"00548ac6b14428719c970ef90adae2b3b48c0cdf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"1d9e2de24533daca36cbf09e8d8596bf72b526b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"838b49e211d59fa827ff9df062d4020917cffbdf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"36c79eb4845551e9f6d28c663b38ce0ab03b84a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"331f91d86f71d0bb89a44217cc0b2a22810bbd42\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/remoteproc/mtk_scp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.92\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.32\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/remoteproc/mtk_scp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf\"}, {\"url\": \"https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2\"}, {\"url\": \"https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\"}, {\"url\": \"https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf\"}, {\"url\": \"https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9\"}, {\"url\": \"https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\\n\\nThe IPI buffer location is read from the firmware that we load to the\\nSystem Companion Processor, and it\u0027s not granted that both the SRAM\\n(L2TCM) size that is defined in the devicetree node is large enough\\nfor that, and while this is especially true for multi-core SCP, it\u0027s\\nstill useful to check on single-core variants as well.\\n\\nFailing to perform this check may make this driver perform R/W\\noperations out of the L2TCM boundary, resulting (at best) in a\\nkernel panic.\\n\\nTo fix that, check that the IPI buffer fits, otherwise return a\\nfailure and refuse to boot the relevant SCP core (or the SCP at\\nall, if this is single core).\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.160\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.92\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.32\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.11\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.2\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:18:01.034Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36965\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:18:01.034Z\", \"dateReserved\": \"2024-05-30T15:25:07.081Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-08T12:52:58.404Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.